What is Claude Code auto mode and should you turn it off?

What auto mode actually does

Auto mode is one of four permission modes in Claude Code. In auto mode the agent does not stop to ask before each file edit, shell command, or git action. Instead, a separate classifier reads the proposed action in the background and blocks the ones it judges to be unsafe; Anthropic reports the classifier blocked 89 percent of dangerous commands in a controlled study of 1,053 paid testers, against 13.6 percent that human manual approval would have caught.

That is the right way to read the number. Auto mode is not magic safety, and human approval is not zero safety. Each path catches a different slice of risky behavior, and neither replaces a careful diff review after the fact.

What changed on August 14, 2026

On Aug 14, 2026, Anthropic made auto mode the default for Pro, Max, Team, and Enterprise plans. Free users are not auto-enrolled, and existing manual-approval settings are not silently overridden for every user on every install, but the practical effect is that most paid Claude Code sessions will start in auto mode whether the user picked it or not.

If you have not opened Claude Code since that date, the permission prompt behavior you remember may no longer match what the tool is doing today. That is the most common reason this question is trending on Google Suggest.

Where auto mode is a fine default

Auto mode is well suited for disposable experiments, sandboxed branches, routine coding work in repositories where a stray edit is recoverable, and any task where the cost of an occasional review-the-diff moment is lower than the cost of an approval prompt at every step.

It is also the right default if your repository is already in a state where you would run claude --dangerously-skip-permissions or accept the accept-edits prompt every time. Auto mode is closer to that workflow than to the strict default that pauses for every command.

Where to turn it off

Turn auto mode off for private or production repositories, for regulated workloads where every shell command needs an audit trail, and for any session where you want a human reviewer to approve each step. The Claude Code documentation lists three alternatives: accept edits, plan mode, and bypass permissions; each gives a different trade-off between speed and oversight.

If you keep auto mode on but want a safety net, give the agent a sandboxed Git worktree, scope any MCP server or shell integration to a narrow tool list, and review the diff before merge. A classifier at write time plus a diff review at commit time is materially stronger than either alone.

• Private or production repositories where every action should be auditable.
• Regulated workloads (financial, healthcare, infrastructure) that need explicit approval steps.
• Sessions where you want the agent to stop and ask before destructive commands.
• First-time runs on a new repository where the agent has not yet earned trust.

Limitations and honest unknowns

Anthropic has not published the false-positive rate of the classifier; a tool that blocks 89 percent of dangerous commands may also block a meaningful share of legitimate work, and you will not see those numbers in vendor docs. Treat the 89 percent figure as a directional data point, not a guarantee.

Auto mode does not extend to MCP servers or third-party plugin code by default; if you connect Claude Code to a filesystem, database, or deployment MCP server, the safety review needs to cover that surface separately. The same caution applies to any session where the agent reads untrusted web pages, issues, or documents that could carry prompt-injection payloads.

A useful next action

Open Claude Code, check whether your session is in auto mode, and decide deliberately. If you keep auto mode on, give the agent a sandboxed worktree, scope every MCP server, and review the diff before commit. If you turn it off, pick the alternative that matches your review budget: accept edits for low-risk work, plan mode for design sessions, bypass permissions only when you have already decided you would approve every step.

The right default is not auto mode or manual mode. It is the mode you have chosen on purpose for the repository in front of you.